Fix packet, delivery, clock and radio stability regressions

Reject truncated anonymous reply paths and advert metadata before copying,
while preserving timestamp-only empty-password logins. Limit room posting to
read-write/admin ACL roles, retain inbox frames until the requesting transport
accepts them, and lock raw LittleFS traversal against concurrent writes.

Separate ISR event generations from main-loop radio state. Confirm RX/TX IRQs,
detach concrete wrapper callbacks safely, and discard inconsistent LR2021 FIFO
snapshots before rearming. Preserve bridge RX frames through packet-pool
exhaustion and bound ESP-NOW retries and missing-callback recovery. Screen RTC
register layouts without losing DS1307 startup, and ignore poisoned future
contact timestamps during clock bootstrap.

Keep the nRF52 loop stack at 8 KiB while reducing the OTA listing call chain
from 7,832 to 6,056 static bytes. Retain all target names through lossless Full
Companion compression and the canonical size optimizer. Preserve constrained
STM32 filesystems and bind corrected ESP32 UART/OLED budgets to source size
assertions. Document the separately measured preexisting W12 package limits.

Adapted for this branch from meshcore-dev/MeshCore PRs #3521, #3340, #3362,
#2062, #3503, #3038, #3534, #3544 and #3512.

Validation: 1,829 native tests; sanitized parser, inbox, LittleFS, ACL, clock,
RTC, IRQ/FIFO and bridge fault tests; 332 additional Companion cases; real
RAK4631 Full and both repeater profiles, G2 Full/standard, V3 Full and both
constrained STM32 release recipes. Radio-family compile coverage continues
separately; W12 full/portable package guards remain enforced.

src/helpers/BaseChatMesh.cpp

@@ -127,16 +127,39 @@ void BaseChatMesh::sendAckTo(const ContactInfo& dest, const uint8_t* ack_hash, u
   }
 }
 
+static uint32_t contactClockBootstrapLimit(uint32_t current_time) {
+  // A corrupt contact must not permanently move the clock into the far future.
+  // Use the build year while the RTC is unset, and a rolling bound when a
+  // long-lived installation already has a clock beyond that build horizon.
+  constexpr const char* date = __DATE__;
+  constexpr unsigned year = (date[7] - '0') * 1000 + (date[8] - '0') * 100
+                          + (date[9] - '0') * 10 + (date[10] - '0') + 4;
+  constexpr unsigned previous_year = year - 1;
+  // Gregorian leap days before this year, minus the 477 before 1970.
+  // Fold the build horizon at compile time instead of linking a calendar loop.
+  constexpr uint64_t days = 365ULL * (year - 1970)
+      + previous_year / 4 - previous_year / 100 + previous_year / 400 - 477;
+  constexpr uint64_t build_limit = days * 86400ULL;
+  constexpr uint32_t build_bound = build_limit < UINT32_MAX
+      ? uint32_t(build_limit) : UINT32_MAX;
+  constexpr uint32_t clock_window = 366UL * 86400UL;
+  const uint32_t clock_bound = current_time > UINT32_MAX - clock_window
+      ? UINT32_MAX : current_time + clock_window;
+  return clock_bound > build_bound ? clock_bound : build_bound;
+}
+
 void BaseChatMesh::bootstrapRTCfromContacts() {
+  const uint32_t current_time = getRTCClock()->getCurrentTime();
+  const uint32_t max_time = contactClockBootstrapLimit(current_time);
   uint32_t latest = 0;
   for (int i = 0; i < num_contacts; i++) {
-    if (contacts[i].lastmod > latest) {
+    if (contacts[i].lastmod > latest && contacts[i].lastmod < max_time) {
       latest = contacts[i].lastmod;
     }
   }
   if (latest != 0 && latest != UINT32_MAX) {
     const uint32_t contact_floor = latest + 1;
-    if (contact_floor > getRTCClock()->getCurrentTime()) {
+    if (contact_floor > current_time) {
       getRTCClock()->setCurrentTime(contact_floor);
     }
   }